# Documentation and samples for deciphering Zoom's context header contain a security vulnerability

**URL:** <https://devforum.zoom.us/t/documentation-and-samples-for-deciphering-zooms-context-header-contain-a-security-vulnerability/128285>\
**Category:** Zoom Apps\
**Created:** [February 24, 2025, 1:29pm UTC](https://devforum.zoom.us/t/documentation-and-samples-for-deciphering-zooms-context-header-contain-a-security-vulnerability/128285 "2025-02-24T13:29:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jim-Bar](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jim-bar/32/66681_2.png) [@Jim-Bar](https://devforum.zoom.us/u/Jim-Bar)\
**Post date:** [February 24, 2025, 1:29pm UTC](https://devforum.zoom.us/t/documentation-and-samples-for-deciphering-zooms-context-header-contain-a-security-vulnerability/128285/1 "2025-02-24T13:29:08Z")

</div>

Hello,

I just want to report a possible security breach present in the documentation and in some samples for decrypting the `X-Zoom-App-Context` HTTP header. A quick search shows that at least those are affected, but there could be more:

- Documentation: `https://developers.zoom.us/docs/zoom-apps/zoom-app-context`
- Basic Zoom Apps JS sample: `https://github.com/zoom/zoomapps-sample-js/blob/main/server/helpers/cipher.js`
- Custom Layout Zoom Apps sample: `https://github.com/zoom/zoomapps-customlayout-js/blob/main/server/helpers/cipher.js`
- Collaborative text editor Zoom Apps sample: `https://github.com/zoom/zoomapps-texteditor-vuejs/blob/main/server/src/helpers/cipher.ts`

The Advanced Zoom Apps sample does not have this issue. The relevant code is:

```auto
const decipher = crypto
    .createDecipheriv(
      "aes-256-gcm",
      crypto.createHash("sha256").update(secret).digest(),
      iv
    )
    (...)

```

The option `autoTagLength` should be set as such:

```auto
const decipher = crypto
    .createDecipheriv(
      "aes-256-gcm",
      crypto.createHash("sha256").update(secret).digest(),
      iv,
      {authTagLength: 16}
    )
    (...)

```

The description of the exploitation can be found there: `https://www.securesystems.de/blog/forging_ciphertexts_under_Galois_Counter_Mode_for_the_Node_js_crypto_module`.

This has been reported by our internal security tools, and we suspect others could introduce this vulnerability in their code by copy/pasting from Zoom’s documentation or samples.

It would be great if all the occurrences could be fixed. Thanks!